Apple's Hide My Email Gave the FBI a User's Real Identity—Plus 134 Anonymous Accounts

How Hide My Email Actually Works

Hide My Email is an iCloud+ feature that lets subscribers generate unique, random email addresses (like abc123@privaterelay.appleid.com) for use with apps, websites, and online forms. Messages sent to these aliases are forwarded to the user's real inbox. The idea is to prevent companies from learning your actual email address.

But there is a fundamental architectural limitation: Apple must know the link between every alias and its owner's real account. Without that mapping, the forwarding would not work. This means Apple maintains a complete database linking every anonymous alias to a real identity, and that database is accessible via legal process.

Unlike end to end encrypted services where the provider genuinely cannot access user data, Hide My Email is a convenience feature, not a security feature. Apple can, and as these cases show, does disclose the real identity behind any alias when presented with a valid warrant or subpoena.

What This Means for Users

Hide My Email protects you from marketers, data brokers, and companies that sell email lists. It does not protect you from governments.

This distinction matters because Apple markets iCloud+ as a privacy suite. Features like Private Relay, Hide My Email, and Custom Email Domains are sold together under a privacy brand. Users may reasonably assume that "hiding" their email means the data is inaccessible to everyone, not just to advertisers.

The reality is more nuanced. Core account details, including the mappings between aliases and real addresses, sit outside the scope of Apple's end to end encryption. They are stored in a way that Apple can access and disclose when legally compelled.

Apple Is Not Unique in This

Every major tech company complies with valid legal requests for user data. Google publishes transparency reports showing hundreds of thousands of government data requests per year. Microsoft, Meta, and Amazon do the same. The difference is that most users do not think of these companies' products as privacy tools.

Apple occupies a unique position because it has built its brand around privacy. "What happens on your iPhone stays on your iPhone" was one of its most prominent advertising campaigns. When a feature called "Hide My Email" turns out to not actually hide your email from anyone with a subpoena, it creates a gap between marketing and reality.

This is similar to how Proton Mail disclosed payment data that identified an anonymous protester to the FBI earlier this year. Privacy tools that operate within existing legal frameworks are ultimately constrained by those frameworks.

The Broader Privacy Lesson

These cases expose a fundamental tension in consumer privacy tools. Features like Hide My Email, VPN services, and encrypted messaging apps offer varying degrees of protection, but none of them operate in a legal vacuum. Any service that knows your identity can be compelled to reveal it.

True anonymity requires that no single entity holds the complete picture. That means:

• End to end encryption where even the service provider cannot access content
• Minimal data retention policies that limit what can be disclosed
• Decentralized architectures where no central party holds the mapping between pseudonyms and real identities
• Payment methods that do not link accounts to real world identity

Hide My Email meets none of these criteria. It is a useful tool for reducing spam and preventing email list sales, but it is not an anonymity tool and should not be treated as one.

What You Should Do

If you use Hide My Email, keep using it. It still protects against the most common email privacy threats: data brokers harvesting your address, companies selling your contact information, and marketing emails that track when you open them.

But understand its limits. If your threat model includes government actors or law enforcement, an email alias forwarding service provides zero meaningful protection. The alias is a thin layer of obfuscation, not encryption, and Apple holds the key to unravel it.

For journalists, activists, and anyone whose privacy concerns extend beyond commercial tracking, the calculus is different. In those cases, the tools that matter are end to end encryption, minimal data retention, and operational security practices that go far beyond what any consumer feature can provide.